savannahcandy.com Listed by ransomhub Ransomware Group

On September 20, 2024, Savannah Candy Kitchen at savannahcandy.com appeared on the RansomHub ransomware leak site. The listing states that internal files were exfiltrated during a ransomware attack on the Southern confectionery company known for pralines, divinity, and pecan pies. The disclosure does not specify the number of people affected or list exact data types beyond the broad category of internal files.

Details in the RansomHub Listing

The primary source, hosted on the RansomHub onion site and indexed by ransomware.live, states that Savannah Candy Kitchen suffered a ransomware incident resulting in data exfiltration. It presents samples of the allegedly stolen material and gives the company a deadline to negotiate before full publication. The listing does not quantify records, name specific databases, or describe customer information, employee payroll, or payment details. Public reporting on RansomHub indicates the group follows a double-extortion model: encryption of victim systems paired with threats to release stolen data.

Why This Matters for You and Your Family

If you have ever ordered gift baskets, corporate sweets, or online shipments from savannahcandy.com, your name, shipping address, email, and payment information may sit inside the internal files now held by RansomHub. Even when exact record counts remain unknown, retail customer databases routinely contain enough personal detail to enable follow-on fraud. Families who placed orders around holidays or sent presents to relatives could see their contact information surface in future dumps, increasing risks of phishing emails that reference real past purchases.

Doxxing and Identity-Chain Risks

Exfiltrated internal files often include spreadsheets that link customer emails to physical addresses, phone numbers, and order histories. Attackers and subsequent data resellers can chain these details with usernames found in other breaches, creating persistent identity profiles. A single leaked order confirmation that ties your email to a Savannah Candy Kitchen purchase can anchor larger doxxing campaigns, especially when combined with credentials reused from earlier retail breaches. Credential leaks like this one cascade into account takeovers, including gaming accounts belonging to you or your children when the same email and password appear across services.

RansomHub’s Known Track Record

Public reporting attributes RansomHub’s emergence to early 2024. The group has claimed responsibility for attacks on organizations across healthcare, manufacturing, and retail sectors. Its typical playbook begins with initial access gained through compromised remote desktop credentials or phishing, followed by rapid exfiltration of internal shares before encryption. RansomHub then posts victim names to its leak site with countdown timers, offering proof files and demanding payment to prevent full data release. The Savannah Candy Kitchen listing follows this exact pattern.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Rotate any password you used at savannahcandy.com anywhere else it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists manage takedown requests for any personal data already appearing on broker sites tied to this incident.

The incident underscores that even a single retail purchase can anchor an identity chain attackers exploit for years. Start your DoxxScan trial today for continuous monitoring, AI-powered identity-chain mapping, and hands-on remediation by specialists that protects your entire family, including children’s gaming accounts. Source: RansomHub leak site via ransomware.live